API Scanner Hierarchies for Runtime Security Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security measures, such as static code scans and dynamic application testing, fail to provide comprehensive protection against potential vulnerabilities in software drivers and applications, particularly during continuous integration/continuous deployment (CI/CD) cycles.
Innovation Solution
Implement a customizable and dynamically alterable scanner system that identifies and categorizes APIs at build time, creating hierarchical scanners for each category, monitors API usage at runtime, and calculates an overall risk score to determine necessary code modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static code scans and dynamic application testing are used, then some security protection is provided, but comprehensive protection against potential vulnerabilities is not achieved
Solution Approach 1:
The patent implements dynamic scanners that are created and configured at runtime based on actual API usage patterns detected during build time scanning. This allows the security system to adapt and respond to actual runtime conditions rather than relying solely on static pre-defined rules, thereby achieving more comprehensive vulnerability detection.
Solution Approach 2:
The system performs build time scanning to identify and categorize APIs before the application runs. This preliminary action creates a foundation for runtime security monitoring by pre-configuring scanners with knowledge of which APIs are present and how they are used, enabling more effective real-time security assessment.
2Measurement precision
If comprehensive API monitoring is implemented, then security risk detection is improved, but resource usage increases
Solution Approach 1:
The patent divides the security monitoring system into multiple hierarchical scanners organized by API categories. Each scanner focuses on specific API groups, allowing the system to monitor comprehensive API usage while distributing resource consumption across multiple specialized components rather than one monolithic scanner.
Solution Approach 2:
The system creates customized scanners with specific monitoring rules tailored to each API category and individual application's usage patterns. This local customization ensures that monitoring resources are concentrated where they are most needed based on actual API usage, rather than uniformly applying monitoring to all possible APIs.
3Productivity
If APIs are identified and categorized at build time, then runtime monitoring efficiency is improved, but build time processing increases
Solution Approach 1:
The system performs API identification and categorization during the build time scanning phase, creating a structured understanding of the application's API usage patterns before runtime. This preliminary analysis enables the runtime system to execute pre-configured monitoring rules without performing complex analysis during execution, thereby improving runtime efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Apparatuses, systems, and techniques to detect potential security risks using application program interface (API) scanners. In at least one embodiment, software is scanned to identify one or more APIs of different categories and the position of the APIs and associated code in an executable file may be altered to reduce one or more potential risks.